PDF file preview

[distantnative]

Description

I think this could be a neat addition for the core. With fallback in case inline PDF viewing isn't supported.

Or if not core, we could release it as small plugin.

Changelog

Feature

• PDF file preview

Ready?

• In-code documentation (wherever needed)
• Unit tests for fixed bug/feature
• Tests and CI checks all pass

For review team

• Add lab and/or sandbox examples (wherever helpful)
• Add changes & docs to release notes draft in Notion

[bastianallgeier]

This is great. The fallback is super elegant. I would only be worried if loading PDFs could lead to any new JS security issues. I've read somewhere that PDFs have optional JS support, which is pretty crazy. But I'm not aware if this could be exploited or not. Maybe @lukasbestle has some additional thoughts?

[distantnative]

mdn has a section on security concerns with frames, but uses object as example for PDFs without any further security mentions: https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Structuring_content/General_embedding_technologies#the_embed_and_object_elements

[lukasbestle]

PDFs do have JS support, but I would assume that when embedding a PDF in <object>, browsers sandbox the embed similar to when using the <img> element with an SVG. So the JS code won't have access to the running Panel instance. However I don't have experience with the <object> element in a security context.

[lukasbestle]

Actually not a very good comparison as SVGs in <img> just don't execute JS at all, but what I wanted to say is that embeds with <object> should not be able to interact with the page.